Live › vulnerability › CVE-2026-117920
Go to dashboardA use-after-free bug in the DOM HTML Parser component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. Freed memory being reused can crash the browser or, in the worst case, let a crafted web page run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR older than the fixed versions, including browsers on managed desktops. The sources do not say which configurations are affected beyond the version. Servers and applications that do not run a Firefox browser can skip it.
No product ranges from the sources yet.
firefox --version159 or later153.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117920")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.